scanning stops when something is found

[merk]

when avast is running a scan and finds something, it opens a popup asking me what to do but stops scanning until i select something.

How can i get avast to keep scanning regardless of if i have answered the popup window?

this is the free home version running under vista ultimate

[oldman]

With the home version, about the only thing you can do, is wait for the first detection, check the box don't show this again, and click no action. At the end of the scan you will get a list of anything found and you can then deal with it. Further configuration options are availible in the pro version.

[merk]

With the home version, about the only thing you can do, is wait for the first detection, check the box don't show this again, and click no action. At the end of the scan you will get a list of anything found and you can then deal with it. Further configuration options are available in the pro version.

ah ok... i saw that checkbox but i was worried it would just automatically delete files. I'd prefer to review what it found and decide what to do with each item. So clicking that box and then selecting no action would be just fine for my purposes.

thanks for the help

[DavidR]

These advanced automated options are only available in the Pro version.

This is a limitation of the Home (free) version that it has interactive input requirement, there have to be differences in the Home/Pro version and this is one of them, the programmers have to eat

As you mention, check the option "Don't show this window again" when the first virus warning appears, select the "No action" button would be a reasonable choice for you, unfortunately you would still have to wait for the first detection assuming you got one.

Over time this will become less of an issue, as the resident, on-access scanners are designed to intercept infection before it gets into your system.

Welcome to the forums.

[merk]

yeah, i can deal with having to wait for the first popup. Worst case ... i'll place a test virus in the first directory it scans to force a popup as soon as the scan starts

I'm not too worried about it though. I just decided to have it do a full system scan since i rarely do those. worryingly, it found a few items, including an item in the hybr.sys and pagefile.sys files. Cant remember the names of them - bleah and bolzark or something like that. Although one of the items it found 'bleah' supposedly prevents the system from booting, and i never had that problem. At least what it did find was in an old install of windows, not my current install. So if i was infected, it was in my last install. So much for windows one care (which is what i was using previously).

I'm wondering if they were false alarms though. Because a couple of days ago i also ran the online scan from trendmicro's housecall and it didnt detect any of the things avast did.

[DavidR]

Well I was under the impression that the pagefile.sys is excluded from scans by default. Check the Standard Shield, Customize, Advanced, Add and check for the value ?:\pagefile.sys if it isn't there I suggest you add it.

I don't know if the hybr.sys is a valid file (google doesn't turn up many hits for it), I though it should be hiberfil.sys or something like that, unless you didn't enter the correct file name ?

When you put a computer in hibernation or on standby, Windows XP saves all system content to the system drive\Hiberfil.sys file before the system shuts down. The Ntldr file examines the integrity of the Hiberfil.sys file. If the Hiberfil.sys file is damaged, you may receive an error message that is similar to the following:

[merk]

Well I was under the impression that the pagefile.sys is excluded from scans by default. Check the Standard Shield, Customize, Advanced, Add and check for the value ?:\pagefile.sys if it isn't there I suggest you add it.

I don't know if the hybr.sys is a valid file (google doesn't turn up many hits for it), I though it should be hiberfil.sys or something like that, unless you didn't enter the correct file name ?

Sorry, i just messed up the name. I couldn't remember what the exact name was.

Why would i want to exclude pagefile.sys? If anything i would have though that would be a critical file I'd want to scan?

Is there any way to get more info on whatever avast finds? I was hoping i could right click the virus name or something and have it open a window which gave more details on the virus. Or is that something in the paid version?

thanks

[DavidR]

Because effectively it only lasts for the duration of your session, reboot and you start over. I also believe that there have been a number of detections on the pagefile.sys (forum search for the file name) and there really is no way of testing it fully as it is such a large file you can't upload it to a multi-engine scanner nor can you easily send it for analysis.

What is in the pagefile was also at some point in your memory and has been swapped out to the pagefile on your HDD, so why was it not detected in memory but yet detected in the pagefile. So personally I have doubts when I can't positively confirm a detection.

You could try a google search on the malware name, but that isn't to reliable as malware names aren't standardised so may differ from one AV to the next.

[merk]

ah ok, that makes sense about the pagefile.

That what i did in this case. I was just hoping maybe avast had a feature to open up their own virus database with their info.

thanks again

[DavidR]

Your welcome.

I tend not to worry too much about what a virus/malware does other than it has been detected and I confirm the detection is good.

But then again I take additional steps to limit the damage any malware can do:
1. Proactive protection, in order to place files in the system folders and create registry entries you need permission. Prevention is much better and theoretically easier than cure.

Whilst browsing or collecting email, etc. if you get infected then the malware by default inherits the same permissions that you have for your user account. So if the user account has administrator rights, the malware has administrator rights and can reap havoc. With limited rights the malware can't put files in the system folders, create registry entries, etc. This greatly reduces the potential harm that can be done by an undetected or first day virus, etc.

Browsing the Web and Reading E-mail Safely as an Administrator. This obviously applies to those NT based OSes that have administrator settings, winNT, win2k, winXP. Check Bob's, setup instructions and importantly the dropmyrights.msi file needed as MS have now cleared the original link. http://mysharedfiles.no-ip.org/dropmyrights

2. I use a drive imaging software and take an image of my hard disk partitions weekly and if something ever gets to a position where it might take more than 15 to fix, I just restore the last back-up image.

[merk]

You are much more organized and diligent then i am

I'm aware of what the rights i run under are the rights any malware will run under. But I never wanted to be bothered with the hassle of running as a limited user. Although i suppose vista has basically forced that hassle on us and I've dealt with it. So i suppose i could have done the same under xp.

I thought about making an image of my partition .. i might still do that. But for now that also seems like too much of a hassle, and a waste of HD space. Even though avast found this potential items, I've never really had any serious problems with my pc (now that i just said that it probably just burst into flames). Generally speaking, my HD's usually get replaced every 2 years or so. So i feel relatively safe. Although i have started using mozy to backup the more important stuff. And i think I'm going to shell out the $5 to upgrade that so i have more room and can do a complete backup. I think that's about as ambitious as i am likely to get

[DavidR]

It is much less hassle under XP with DMR as you continue to have admin rights, just limiting the applications you want to run with limited rights. Once set up no further input is required no hassle like UAC with Vista.

You won't feel that way about space and hassle when you have to use it in earnest to recover from a major disaster. Drive Image has saved my ass on many occasions and it really isn't much hassle.

[merk]

So with DMR you are specifically setting certain apps to run in a less limited mode? i.e. instead of 'run as admin' you are basically doing 'do not run as admin' ?

Somewhat of a moot question though since I'm not rolling back to xp.

The main reason i dont bother with drive imaging is the amount of diskspace needed. I would basically need double the hard drives to make an image of all the partitions. I guess i could just image my boot partition, which would mean i'd only need i think 40gb - or less then that considering i think i have 15gb of freespace. Maybe I'll try that - what software do you use for that? I have the software from acronis, which i think includes imaging, not sure.

Worst case scenario - i have more of an excuse to buy a 1tb drive

[DavidR]

Yes similar to a reverse of run as admin in a limited user account.

Were you use a shortcut to launch an application you use a modified shortcut that runs the DMR executable at the end of that is the path to the application you want to run with limited rights.

Most imaging software also compresses the image to help with back-up image file size. As you mention it is easier if you have large HDDs partitioned and most corruption that would cause a problem is likely to be your primary partition.